T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:38
- Finding
- Persistent Behavioral Instruction Hijacking Through Automatically Loaded State Files## Vulnerability Details **File Location**: `SKILL.md:38-65`; related promotion rules in `references/protocol.md:57-91` and `references/protocol.md:107-119` **Vulnerability Type**: Persistent instruction and memory hijacking **Risk Level**: Critical ### Vulnerable Code Snippet ```markdown ## Session Startup — always do this first Before taking any action in a new session, read the following files if they exist: - `soul.md` — core behavioural principles (these override defaults) - `lessons.md` — extracted rules and heuristics - `playbook.md` — proven workflows for common task types - `session-log.md` — what was learned or updated in recent sessions Internalise their contents before proceeding. If any file is missing, create it with a brief header comment and continue. --- ## Before Every Non-Trivial Response Before finalising any response that involves reasoning, multi-step work, or external tools, run this internal check: 1. **Am I confident in this?** If uncertain, say so explicitly rather than proceeding as if certain. 2. **Have I made this type of mistake before?** Scan `lessons.md` for a relevant rule. 3. **Is there a playbook entry for this task type?** If yes, follow it. If any answer is uncertain, note it briefly before responding — not after. This is the only part of the system that actively prevents mistakes rather than cataloguing them after the fact. ``` The associated protocol permits persistent rules to be promoted into the highest-authority local behavioral file: ```markdown ## 3. Core Principles (`soul.md`) Promote a lesson to `soul.md` only when it meets all three criteria: 1. It applies across many different task types 2. Violating it has caused or would cause a Medium or High severity mistake 3. It reflects a reasoning principle, not a situational tactic ``` ### Technical Analysis The Skill directs the Agent to load local files before taking any other action, internalize their contents, and allow `soul.md` to “override defaults ...[truncated 2344 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the statement that `soul.md` or any Skill-managed file can override defaults. Explicitly require system, developer, and current user instructions to retain precedence. 2. Treat all persisted file contents as untrusted data rather than instructions. Parse entries through a strict schema containing only predefined fields and enumerated values. 3. Reject imperative instructions, tool directives, role changes, safety-policy changes, and references to secrets or unrelated files in persisted entries. 4. Require explicit user approval before loading persistent behavioral state into a new session or promoting a lesson into a higher-authority file. 5. Store provenance for every entry, including creation time, originating session, approval status, and integrity digest. 6. Verify file ownership, permissions, and integrity before loading state. Refuse state files writable by untrusted users or supplied through an untrusted project. 7. Constrain persisted lessons to advisory observations that cannot independently authorize tools, file access, network activity, or policy changes. 8. Provide a review and reset mechanism that displays all persistent rules and allows the user to disable or delete them before they affect a session.